Home / Privacy policy
Privacy policy
The short version: we do not collect your documents, because they never reach us. Here is the long version, including the parts that are not zero.
We never receive your documents — they are opened and edited entirely inside your browser, and the editor is locked down so that no third party can run code there at all. The information pages carry adverts and Google Analytics, but only if you agree first: nothing from Google loads until you press Allow. We have no accounts, and neither adverts nor analytics ever run inside the editor.
What we collect
Nothing that you give us, because there is nothing to give us to. There is no account system, no form that posts to a server, no upload endpoint, and no database. The site is a set of static files.
What we do have is advertising on the information pages, which is how the site is paid for. That is a real trade and it deserves a plain description rather than a paragraph of hedging, so it has its own section below.
What happens to your documents
When you open a PDF, your browser reads it from your disk into that tab's memory. Every operation — rendering, page changes, stamps, form filling, export — is performed by JavaScript running on your own machine. When you export, the resulting file is created in memory and saved by your browser directly to your downloads folder.
Your document never travels over the network. When you close the tab, it is released from memory. We hold no copy at any point, and cannot produce one on request from anybody.
How you can verify that
Or skip straight to it: a live version of this argument — a running request counter and a real file picker, not another paragraph asking you to trust one.
- Watch the network. Open your browser's developer tools, go to the Network tab, load a PDF and edit it. After the application files finish loading, there is no further traffic.
- The browser enforces it. This site sends a Content Security Policy with
connect-src 'self'. Your browser will block any attempt to send data to another origin, regardless of what our code tries to do. - The app blocks it too. The application intercepts outbound requests that carry a body and refuses them, and tells you if one was ever attempted.
- Unplug the network. Load the page, disconnect, and keep working. Software that needed to send your file somewhere could not do that.
What is stored on your device
| What | Where | Why |
|---|---|---|
| Stamps and saved signatures you design | Browser local storage | So they are still there tomorrow. Contains no document content. |
| Recoverable work — your actual edits on a document you have open | Browser IndexedDB | So closing a tab by accident does not lose what you were doing. This is the one exception to "no document content" above, and it is a deliberate one: stated here plainly, shown in the app’s own History panel rather than hidden, deletable individually or all at once, and never transmitted regardless. |
| The last few signatures you placed | Browser IndexedDB | Fast access to "the one I just used again", shown and deletable in the same History panel. |
| Application files | Browser cache / service worker | So the editor works offline. |
| Your advertising choice | Browser local storage | So you are asked once rather than on every page. |
All of these live on your machine and are never transmitted anywhere. Clearing site data in your browser removes all of it; the recoverable-work and recent-signature rows can also each be cleared or deleted individually, right from the panel that shows them.
Server logs
This site is served by Cloudflare Pages. Like any web host, Cloudflare records standard request metadata — IP address, timestamp, requested path, user agent — for security, abuse prevention and reliability. We do not use these logs to build profiles, we do not combine them with anything else, and we do not sell or share them. They cover requests for pages and assets only; they cannot contain your document because your document is never requested from or sent to a server.
If even that is more than you want, download the single-file build and run it from your own disk. Then there are no requests at all.
Advertising
The information pages — the ones you are reading now — can carry Google AdSense adverts. That is how the tools stay free with no account and no limits.
- Nothing loads until you agree. On your first visit you are asked. Until you answer, no Google script is fetched, no cookie is set and no request is made. Consent that fires the tag first and asks afterwards is not consent.
- If you decline, the slots are removed from the page, and you are not asked again on that browser.
- If you agree, Google sets advertising cookies and uses your IP address and browsing to choose what to show. Google is an independent controller of that data; their policy is at policies.google.com/technologies/ads.
- You can change your mind at any time using the button below.
Analytics
The information pages also use Google Analytics, so we can see which pages are actually useful — nothing more specific than page views and rough traffic sources. Disclosed here rather than gated behind a consent click, for a reason worth stating rather than assuming: it produces only an anonymous, aggregate measurement, not an identifying profile, so it is held to a different standard than advertising above rather than the same one.
- Loads automatically on these information pages, without a prompt. If that is more than you want, blocking scripts from
googletagmanager.comat the browser level stops it entirely, or use the single-file build below, which never loads it at all. - IP addresses are anonymised before Google's servers log them, trimming the last portion of the address rather than sending it in full. A page-view count does not need more than that.
- It sets its own cookies automatically, to distinguish one visit from another. We set none of our own.
- It never sees your documents, because nothing about a document you open or edit is ever part of what analytics measures — it only knows a page in a browser was visited, the same as it would for any static website.
The editor is different, and enforced
Neither advertising nor analytics code runs at /edit-pdf/. This is not a policy we ask you to trust — that path is served with a stricter Content Security Policy permitting no third-party origin whatsoever, so your browser would refuse to load either one there even if we added it by mistake. Check the response headers yourself.
The same applies to your documents everywhere on the site: they are never uploaded, with or without advertising or analytics, because there is no upload mechanism to abuse.
Other third parties
Apart from advertising and analytics, there are none: no fonts loaded from elsewhere, no chat widget, no embedded video, no social buttons. Our only processor is Cloudflare as host.
Children
The Service is not directed at children and collects no personal data from anyone, including children.
Your rights
Data protection law gives you rights of access, correction, deletion and portability over personal data an organisation holds about you. We hold none, so in practice there is nothing to exercise those rights against. If you believe otherwise, write to hello@ofcpdf.com and we will answer honestly.
Changes
If this policy ever changes materially, the change will appear here with a new date, and the substance of the change will be described rather than buried. For a product whose entire proposition is privacy, a quiet edit to this page would be the end of it.
Contact
hello@ofcpdf.com — Ofcpdf, Republic of Maldives.
Straight answers
Do you receive my PDF files?
No. They are opened and processed inside your browser. There is no upload step and no server that could receive them. This is unaffected by advertising.
Do you show adverts?
Yes, on the information pages, and only if you agree first. Nothing from Google loads until you press "Allow adverts" — no script, no cookie, no request. If you decline, the ad slots are removed from the page entirely.
Are there adverts in the editor?
No, and there never will be. The editor at /edit-pdf/ is served with a stricter Content Security Policy that permits no third-party origin at all, so your browser would block an advert there even if we tried to add one.
Do adverts see my documents?
No. Advertising code only ever runs on the information pages, never on the editor, and your document never leaves your device in either place. There is no mechanism by which an advertiser could receive it.
Do you use cookies?
Google Analytics sets its own cookies automatically on these information pages, to distinguish one visit from another. If you allow adverts, Google sets separate advertising cookies too. We set none of our own. Your saved stamps, saved signatures, advertising choice, and recoverable work are kept in your browser's own local storage on your machine and are never transmitted.
Do you use analytics or trackers?
We use Google Analytics on these information pages, disclosed here rather than gated behind a consent click, since it only ever produces an anonymous, aggregate page-view count. IP addresses are anonymised before Google logs them. It never runs on the editor at /edit-pdf/, which keeps the stricter Content Security Policy that permits no third-party origin at all. Adverts are held to a stricter standard and still require explicit consent, since they involve real advertising cookies and IP-based targeting. The privacy monitor inside the app is computed locally and never transmitted, regardless.
Does "recoverable work" contradict "you never keep my documents"?
It is a real, deliberate exception to that promise, and worth answering directly rather than glossing over. The editor now saves your actual in-progress edits — not the original file itself, which is still never kept — to this browser's own local storage, so an accidentally closed tab does not lose your work. It is never transmitted anywhere, it is shown plainly in the app's own History panel rather than hidden, and every entry can be deleted individually or all at once from that same panel, including on the offline single-file build, which carries the same feature since it runs the same code.
What does your host log?
Cloudflare, which serves the static files, keeps standard request logs including IP address and user agent for security and abuse prevention. That is unavoidable for anything served over the internet, it applies to page and asset requests only, and it never includes document content because document content is never sent.